EUVD-2026-35008
GHSA-fxr3-gvm4-m8vc
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from Vendor (VulDB) · only source for this CVE.
CVSS VectorVendor: VulDB
Lifecycle Timeline
4DescriptionCVE.org
A vulnerability was detected in hs-web hsweb-framework up to 5.0.1. This affects the function OAuth2Client of the file hsweb-authorization/hsweb-authorization-oauth2/src/main/java/org/hswebframework/web/oauth2/server/OAuth2Client.java of the component OAuth2 Client. The manipulation results in open redirect. The attack can be executed remotely. The exploit is now public and may be used. The patch is identified as c2882679a9125cea52678151af5ae213cbd52579. Applying a patch is advised to resolve this issue.
AnalysisAI
Open redirect in hs-web hsweb-framework's OAuth2Client component (versions up to 5.0.1) allows remote unauthenticated attackers to redirect victims to attacker-controlled URLs by supplying a crafted redirect_uri during OAuth2 authorization flows. The root cause is a naive prefix-based string comparison using startsWith() in OAuth2Client.java, which trivially allows bypass via domain-prefix spoofing (e.g., registering https://app.example.com.attacker.com when the legitimate URI is https://app.example.com). Publicly available exploit code exists per GitHub issue #354 and CVSS E:P; no public exploit identified at time of analysis in CISA KEV, and the CVSS 4.0 score of 2.1 reflects the limited impact and required user interaction.
Technical ContextAI
The vulnerability resides in OAuth2Client.java within the hsweb-authorization-oauth2 module of hsweb-framework, a Java Spring-based enterprise application development framework (CPE: cpe:2.3:a:hs-web:hsweb-framework:*:*:*:*:*:*:*:*). CWE-601 (URL Redirection to Untrusted Site) describes the root cause: the original redirect URI validation used ObjectUtils.isEmpty() combined with String.startsWith() to compare the supplied redirect_uri against the registered client redirectUrl. This string-prefix approach is fundamentally insecure - any attacker-controlled domain that begins with the registered URI prefix passes validation. The patch (commit c2882679a9125cea52678151af5ae213cbd52579, PR #355) replaces this entirely with a java.net.URI-based parser that validates scheme (case-insensitive), user info, host, port, path, and query parameters independently, rejects URIs containing fragments, normalizes paths before comparison, and introduces two validation modes via OAuth2Properties.RedirectUriValidationMode: COMPATIBLE (allows sub-paths of the registered URI) and EXACT (strict full-match). The fix also addresses a secondary issue in secret validation by replacing ObjectUtils.isEmpty() with StringUtils.hasLength() for improved reliability.
RemediationAI
Apply the upstream fix identified as commit c2882679a9125cea52678151af5ae213cbd52579, available via GitHub PR #355 at https://github.com/hs-web/hsweb-framework/pull/355. Note that this is an upstream patch via commit and PR - a specific tagged release version incorporating the fix has not been independently confirmed in the available data, so verify that the next official release from the hs-web repository includes this commit before upgrading. As a compensating control prior to patching, restrict OAuth2 client redirect URIs to the most specific possible registered values and enforce exact-match validation at the application or API gateway level if configurable. Disabling public OAuth2 client registration or OAuth2 authorization endpoints entirely is the most effective temporary mitigation if the feature is not operationally required, though this will break OAuth2-dependent integrations. Implementing a WAF rule to block redirect_uri values that do not exactly match a known allowlist of registered URIs for the /oauth2/authorize endpoint is a lower-disruption workaround, with the trade-off that WAF rule maintenance may lag behind client URI changes.
Oracle Java SE 7 Update 6 and earlier contains multiple sandbox bypass vulnerabilities via the ClassFinder and forName m
Remote code execution in IBM Sterling B2B Integrator, Sterling Integrator, and Tivoli Common Reporting allows unauthenti
Java Runtime Environment sandbox bypass via incorrect image channel verification in 2D component allows remote unauthent
Oracle Java SE JDK/JRE 7 and 6 Update 27 and earlier allows remote code execution with complete system compromise throug
JBoss Seam 2 in Red Hat JBoss EAP 4.3.0 fails to sanitize JBoss Expression Language inputs, allowing remote attackers to
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 update 4 and earlier, 6 up
Multiple vulnerabilities in Oracle Java 7 before Update 11 allow remote attackers to execute arbitrary code by (1) using
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 2 and earlier, 6 Up
The WLS Security component in Oracle WebLogic Server 10.3.6.0, 12.1.2.0, 12.1.3.0, and 12.2.1.0 allows remote attackers
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 7 and earlier allow
Remote unauthenticated attackers can execute arbitrary code on Adobe ColdFusion servers through Java deserialization fla
The ExceptionDelegator component in Apache Struts before 2.2.3.1 interprets parameter values as OGNL expressions during
Share
External POC / Exploit Code
Leaving vuln.today